forked from juice-shop/juice-shop
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Disable "Forged JWT" challenge on Windows
- Loading branch information
1 parent
07d564d
commit c1ccf72
Showing
10 changed files
with
58 additions
and
36 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,6 +2,7 @@ | |
| * Copyright (c) 2014-2020 Bjoern Kimminich. | ||
| * SPDX-License-Identifier: MIT | ||
| */ | ||
| const utils = require('../../lib/utils') | ||
|
|
||
| describe('/', () => { | ||
| describe('challenge "jwtUnsigned"', () => { | ||
|
|
@@ -13,12 +14,14 @@ describe('/', () => { | |
| protractor.expect.challengeSolved({ challenge: 'Unsigned JWT' }) | ||
| }) | ||
|
|
||
| describe('challenge "jwtForged"', () => { | ||
| it('should accept a token HMAC-signed with public RSA key with email [email protected] in the payload ', () => { | ||
| browser.executeScript('localStorage.setItem("token", "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjp7ImVtYWlsIjoicnNhX2xvcmRAanVpY2Utc2gub3AifSwiaWF0IjoxNTgzMDM3NzExfQ.gShXDT5TrE5736mpIbfVDEcQbLfteJaQUG7Z0PH8Xc8")') | ||
| browser.get('/#/') | ||
| }) | ||
| if (!utils.disableOnWindowsEnv()) { | ||
| describe('challenge "jwtForged"', () => { | ||
| it('should accept a token HMAC-signed with public RSA key with email [email protected] in the payload ', () => { | ||
| browser.executeScript('localStorage.setItem("token", "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjp7ImVtYWlsIjoicnNhX2xvcmRAanVpY2Utc2gub3AifSwiaWF0IjoxNTgzMDM3NzExfQ.gShXDT5TrE5736mpIbfVDEcQbLfteJaQUG7Z0PH8Xc8")') | ||
| browser.get('/#/') | ||
| }) | ||
|
|
||
| protractor.expect.challengeSolved({ challenge: 'Forged Signed JWT' }) | ||
| }) | ||
| protractor.expect.challengeSolved({ challenge: 'Forged Signed JWT' }) | ||
| }) | ||
| } | ||
| }) | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,6 +11,7 @@ chai.use(sinonChai) | |
| const cache = require('../../data/datacache') | ||
| const insecurity = require('../../lib/insecurity') | ||
| const config = require('config') | ||
| const utils = require('../../lib/utils') | ||
|
|
||
| describe('verify', () => { | ||
| const verify = require('../../routes/verify') | ||
|
|
@@ -281,37 +282,39 @@ describe('verify', () => { | |
| expect(challenges.jwtForgedChallenge.solved).to.equal(false) | ||
| }) | ||
|
|
||
| it('"jwtForgedChallenge" is solved when forged token HMAC-signed with public RSA-key has email [email protected] in the payload', () => { | ||
| /* | ||
| Header: { "alg": "HS256", "typ": "JWT" } | ||
| Payload: { "data": { "email": "rsa_lord@juice-sh.op" }, "iat": 1508639612, "exp": 9999999999 } | ||
| */ | ||
| this.req.headers = { authorization: 'Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjp7ImVtYWlsIjoicnNhX2xvcmRAanVpY2Utc2gub3AifSwiaWF0IjoxNTgyMjIxNTc1fQ.ycFwtqh4ht4Pq9K5rhiPPY256F9YCTIecd4FHFuSEAg' } | ||
| if (!utils.disableOnWindowsEnv()) { | ||
| it('"jwtForgedChallenge" is solved when forged token HMAC-signed with public RSA-key has email [email protected] in the payload', () => { | ||
| /* | ||
| Header: { "alg": "HS256", "typ": "JWT" } | ||
| Payload: { "data": { "email": "rsa_lord@juice-sh.op" }, "iat": 1508639612, "exp": 9999999999 } | ||
| */ | ||
| this.req.headers = { authorization: 'Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjp7ImVtYWlsIjoicnNhX2xvcmRAanVpY2Utc2gub3AifSwiaWF0IjoxNTgyMjIxNTc1fQ.ycFwtqh4ht4Pq9K5rhiPPY256F9YCTIecd4FHFuSEAg' } | ||
|
|
||
| verify.jwtChallenges()(this.req, this.res, this.next) | ||
| verify.jwtChallenges()(this.req, this.res, this.next) | ||
|
|
||
| expect(challenges.jwtForgedChallenge.solved).to.equal(true) | ||
| }) | ||
| expect(challenges.jwtForgedChallenge.solved).to.equal(true) | ||
| }) | ||
|
|
||
| it('"jwtForgedChallenge" is solved when forged token HMAC-signed with public RSA-key has string "rsa_lord@" in the payload', () => { | ||
| /* | ||
| Header: { "alg": "HS256", "typ": "JWT" } | ||
| Payload: { "data": { "email": "rsa_lord@" }, "iat": 1508639612, "exp": 9999999999 } | ||
| */ | ||
| this.req.headers = { authorization: 'Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjp7ImVtYWlsIjoicnNhX2xvcmRAIn0sImlhdCI6MTU4MjIyMTY3NX0.50f6VAIQk2Uzpf3sgH-1JVrrTuwudonm2DKn2ec7Tg8' } | ||
| it('"jwtForgedChallenge" is solved when forged token HMAC-signed with public RSA-key has string "rsa_lord@" in the payload', () => { | ||
| /* | ||
| Header: { "alg": "HS256", "typ": "JWT" } | ||
| Payload: { "data": { "email": "rsa_lord@" }, "iat": 1508639612, "exp": 9999999999 } | ||
| */ | ||
| this.req.headers = { authorization: 'Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjp7ImVtYWlsIjoicnNhX2xvcmRAIn0sImlhdCI6MTU4MjIyMTY3NX0.50f6VAIQk2Uzpf3sgH-1JVrrTuwudonm2DKn2ec7Tg8' } | ||
|
|
||
| verify.jwtChallenges()(this.req, this.res, this.next) | ||
| verify.jwtChallenges()(this.req, this.res, this.next) | ||
|
|
||
| expect(challenges.jwtForgedChallenge.solved).to.equal(true) | ||
| }) | ||
| expect(challenges.jwtForgedChallenge.solved).to.equal(true) | ||
| }) | ||
|
|
||
| it('"jwtForgedChallenge" is not solved when token regularly signed with private RSA-key has email [email protected] in the payload', () => { | ||
| const token = insecurity.authorize({ data: { email: '[email protected]' } }) | ||
| this.req.headers = { authorization: 'Bearer ' + token } | ||
| it('"jwtForgedChallenge" is not solved when token regularly signed with private RSA-key has email [email protected] in the payload', () => { | ||
| const token = insecurity.authorize({ data: { email: '[email protected]' } }) | ||
| this.req.headers = { authorization: 'Bearer ' + token } | ||
|
|
||
| verify.jwtChallenges()(this.req, this.res, this.next) | ||
| verify.jwtChallenges()(this.req, this.res, this.next) | ||
|
|
||
| expect(challenges.jwtForgedChallenge.solved).to.equal(false) | ||
| }) | ||
| expect(challenges.jwtForgedChallenge.solved).to.equal(false) | ||
| }) | ||
| } | ||
| }) | ||
| }) | ||